Subject: RE: new dhcp aaa requirements draft

From: Tony McAuley <[email-masked]>
Date: Fri, 10 Mar 2000 17:20:08 -0500

Appreciate your comments.

I agree that the main point is whether DHC-wg should care about
inter-realm
configuration. If DHC-wg does not think we should care, then I agree
that
AAA requirements go away. Hopefully, however, we can convince DHC-wg
that it should care (see draft-ietf-dhc-enhance-requirements-00.txt);
in which case DHCP needs not only authentication, but also authorization

(to use resources) and accounting (i.e., to interact with AAA).

Hope this clears things a little?

Thanks
 Tony

*************************************************************************

> From: "Bernard Aboba" <[email-masked]>
> To: DHCPv4 discussion list <[email-masked]>
> Subject: RE: new dhcp aaa requirements draft
> Date: Thu, 9 Mar 2000 23:36:07 -0800
>
> Some comments on this draft:
>
> 1. Much as was the case with Mobile IP registration,
> the default authentication methods specified in the
> DHCP authentication draft are not very compatible with
> AAA in that they require not only verification of the
> DHCP authentication option, but also *generation* of
> the option on behalf of the DHCP server. The latter
> is not something that most AAA servers are prepared
> to do. So trying to interface the DHCP authentication
> draft to AAA seems a tenuous proposition at best.
>
> 2. If one uses either of the other DHCP authentication
> drafts (public key or Kerberos) then conventional AAA
> is not necessary since these methods allow evaluation
> of the client credentials by the DHCP server without
> AAA remoting. Since DHCP servers have their own configuration,
> it would seem that AAA authorization is irrelevant as
> well.
>
> 3. This draft begs the question as to whether the DHC
> WG cares about inter-realm DHCP authentication or not.
> If not, then roaming compatibility is not a goal either.
> The DHCP authentication draft claims this is out of
> scope, yet it is addressed by the other two drafts.